Sammy asked for cookie management that is true to what the site does, with Google Analytics added under the same rules.
What changed for visitors
- A cookie bar across the bottom of the page asks on a first visit, with Reject all, Choose and Accept all given equal weight. Choose opens a panel with three categories: necessary (always on), analytics and marketing.
- Nothing optional loads until a visitor agrees. Before, Microsoft Clarity and Meta Pixel loaded on a visitor’s first click or key press unless their browser sent Global Privacy Control or Do Not Track.
- Google Analytics (measurement ID
G-MGJELF5Z4R) is new. It loads only with analytics consent, and Google’s consent mode starts every Google storage setting as denied and follows the visitor’s choice; advertising storage stays denied unless marketing is allowed. - Meta’s server-side events are forwarded only when the visitor has allowed marketing. The site’s server checks the consent cookie itself, as well as the browser’s privacy signals.
- Global Privacy Control and Do Not Track still switch everything optional off, and a browser that sends either is not shown the bar.
- Cookie choices sits beside Privacy and Terms in every footer, so a choice can be changed or withdrawn from any page. Withdrawing a category removes its cookies and reloads the page so its scripts stop.
- The bar and panel read in every published language and follow the dark, light and high-contrast themes. On a first visit the language offer waits until the bar is answered.
- The no-script Meta Pixel image is gone from the eight pages that had it, since it fired before anyone could agree. The 404 page’s own copy of the analytics code was replaced with the shared, consent-aware script.
Privacy policy
The policy now says that optional analytics load only with consent, describes Google Analytics
and its cookies, says that the site sets one cookie of its own (cc_cookie, which remembers the
choice for six months), and lists Cookie choices under Your choices.
Under the hood
- The bar is CookieConsent 3.1.0 by Orest Bida (MIT licence), served from the site itself and loaded only when there is something to ask or Cookie choices is opened.
Verification
- A browser walk-through, with every request to Google, Microsoft and Meta recorded and blocked, confirmed that nothing loads before a choice or after Reject all, that Accept all loads all three, that analytics alone loads Google and Clarity but not Meta, and that Global Privacy Control shows no bar and loads nothing.
tools/test-worker.mjschecks that Meta events are refused without marketing consent, andtools/test-site-chrome.mjsthat every page has Cookie choices in its footer.